Executive brief
Linuxfabrik monitoring-plugins is a collection of Python scripts used to monitor system health in IT environments. A security flaw in version 6.0.0 allows a local attacker to trick the system into modifying or corrupting files they should not have access to. This occurs during a background database migration process and could lead to data corruption or unauthorized file changes if the system is not configured with standard modern security protections.
Technical details
A symlink following vulnerability (CWE-59) exists in the logfile check's legacy database migration logic in Linuxfabrik monitoring-plugins v6.0.0. The plugin attempts to move a database from a predictable, world-writable path in /tmp using os.rename() to a secured directory. A local attacker controlling the plugin's service account can place a symlink at the predictable path; because os.rename() moves the symlink itself into the secure directory, subsequent validation is bypassed, and sqlite3.connect() follows the link while running as root. This allows for arbitrary file corruption or redirection of SQLite writes to unintended files, though it primarily affects systems where fs.protected_symlinks is disabled. The migration logic was removed in version 6.0.1 to resolve the issue.
Affected products
- Linuxfabrik monitoring-plugins 6.0.0
Timeline
- 2026-07-07: advisory: GitHub Security Advisory GHSA-w2gg-hx6w-24w3 published
- 2026-07-29: disclosed: CVE-2026-67433 published to NVD
- 2026-07-07: patched: Fixed in version 6.0.1 via removal of migration logic